What happened at Binance?
The path from developer laptops to wallet signing operations.
- Fake interview
- Work laptop
- Stolen token
- Signing service
How did the chain unfold? Where could an earlier warning have changed the response?
10 pages · English →It wasn’t one breach.
- June
Tampered tool installation
A’s tampered Homebrew install was detected. Device replaced; credentials rotated.
- September
Fake recruitment interview
A fake interview assignment ran malware during setup on B’s work computer.
- 20 October
Internal AI tool as a springboard
Access expanded from B to A and C. A held a deployment token.
- 29 October
Into wallet signing
From C, the attacker used A’s token to deploy a container and run malicious code.
One foothold. Multiple paths.
A familiar path. A replaced program.
The malware replaced pyenv inside a familiar developer-tool path.
- 01
pyenv_3,414 BReplacement file created - 02
pyenv3,344 BLegitimate file deleted - 03
pyenv_ → pyenv3,414 BReplacement took its place - 04
symlink + zshSymlink recreated; shell spawned
Binance says endpoint protection missed the initial malware. The file path still looked familiar.
Source / BinanceWithdrawals stopped. Permissions remained.
The attacker used the signing service to establish EIP-7702 delegations. Those permissions operated outside the normal withdrawal flow.
What to check, stage by stage.
Seven stages. Seven places to look in your own environment.
| Stage | What happened | ATT&CK | Check in your environment |
|---|---|---|---|
| June | A tampered Homebrew installation, found through a search engine; Binance calls it a supply chain attack. | T1195 Supply Chain Compromise | Where developers get installers for tools, and whether package sources are pinned and verified. |
| September | Contact through a job platform; an interview “assignment” ran malicious code during setup on a work computer. | T1566.003 Spearphishing via Service · T1204.002 User Execution | Whether take-home code from outside the company can run on corporate devices, and where it should run instead. |
| September | A legitimate pyenv component replaced by a malicious one; traces removed. Endpoint protection missed it. | T1554 Compromise Host Software Binary · T1070 Indicator Removal | Integrity monitoring for developer-tool binaries in package-manager paths, not only for system binaries. |
| 20 October | An internal AI tool used from the compromised computer to gain control over two more engineers. | TA0008 Lateral Movement | What your internal AI tools can reach and do on a user’s behalf, and whether their actions are logged per user. |
| 20 October | A container deployment token found on an engineer’s computer. | T1552 Unsecured Credentials | Standing deployment tokens on laptops: their scope, lifetime and where else they work. |
| 29 October | From a third engineer’s computer, the stolen token was used to deploy a container and run a malicious script. | T1078 Valid Accounts · T1610 Deploy Container | Alerts when a credential is used from a host other than its owner’s, and approval for deployments that reach signing systems. |
| 29 October | The signing service was used to establish EIP-7702 delegations that outlived the withdrawal pause. | On-chain authorization | Signing-policy coverage for authorization types, and monitoring of delegations on hot wallets. |
- How the internal AI tool was used to gain control over Engineers A and C.
- How the deployed container reached the wallet signing service.
- Technical details Binance is keeping confidential to avoid helping other attackers.
- The results of the independent review Binance has commissioned. The investigation is ongoing.
Turn the search for access into an alert.
FalseTrail could have helped when the attacker searched for and tried credentials.
An earlier signal gives the SOC a chance to investigate before the next production step.
Analysis / FalseTrailA decoy. A signal. Evidence of what’s next.
- 01 · Place
Believable decoy credentials and configs
Identifiable placements with no real production authority.
- 02 · Detect
Credential use becomes an alert
Send the finding to the security tools the team already uses.
- 03 · Observe
A controlled trail through fake services
If the trail continues, see what they attempt inside those services.
Your infrastructure. Your evidence.
On-prem · Your cloud / BYOC · Hybrid
Raw evidence stays in your environment. Your forwarder decides where findings go.
Missing the entry needn’t mean missing the intruder.
An intruder may already be inside. Later use of a planted credential can still expose them.
Relevant placements
Place approved decoy configs and service references where an intruder is likely to look for access.
A response path
Validate the alert. Investigate the real host, rotate exposed real credentials and assess the scope.
AI makes more paths easier to explore. Deception creates a detection opportunity in the search for access itself.
- Binance / Initial findings and response update3 November 2026
- MITRE ATT&CKEnterprise techniques
- FalseTrail / DeploymentCustomer-hosted / zero outbound
- Google / Mandiant / ARTEX and FriendsAI attack context / 30 October 2026
Independent FalseTrail analysis of public initial findings, as of 4 November 2026. Binance’s investigation is ongoing. The security team owns investigation and containment in real systems.
See the next attempt at access.
On-prem, your cloud/BYOC or hybrid. Zero outbound connections. Raw evidence stays in your environment.